REST API: Normalize non-integer attachment filesize metadata.

* The return value of the `WP_REST_Attachments_Controller::get_attachment_filesize()` method is narrowed from `int|null` to `non-negative-int|null`.
* The stored `filesize` attachment metadata is only returned if it is a numeric value and is greater than zero; it is cast to an `int`, preventing a `TypeError` if a non-numeric string was stored in metadata.
* The `filesize` property of the attachments endpoint adds `null` as a possible value in addition to `integer`.

Developed in WordPress#12611.
Follow-up to r62813, r61703.

Props apermo, westonruter, xate, mukesh27.
Fixes #65670.


git-svn-id: https://develop.svn.wordpress.org/trunk@62815 602fd350-edb4-49c9-b593-d223f7449a82

Author: westonruter

src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -1707,7 +1707,7 @@ public function get_item_schema() {
 
 		$schema['properties']['filesize'] = array(
 			'description' => __( 'Attachment file size in bytes.' ),
-			'type'        => 'integer',
+			'type'        => array( 'integer', 'null' ),
 			'context'     => array( 'view', 'edit' ),
 			'readonly'    => true,
 		);
@@ -2359,12 +2359,13 @@ protected function get_attachment_filename( int $attachment_id ): ?string {
 	 *
 	 * @param int $attachment_id Attachment ID.
 	 * @return int|null Attachment file size in bytes, or null if not available.
+	 * @phpstan-return non-negative-int|null
 	 */
 	protected function get_attachment_filesize( int $attachment_id ): ?int {
 		$meta = wp_get_attachment_metadata( $attachment_id );
 
-		if ( isset( $meta['filesize'] ) ) {
-			return $meta['filesize'];
+		if ( isset( $meta['filesize'] ) && is_numeric( $meta['filesize'] ) && $meta['filesize'] > 0 ) {
+			return (int) $meta['filesize'];
 		}
 
 		$original_path = wp_get_original_image_path( $attachment_id );

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -1005,6 +1005,114 @@ public function test_get_item() {
 		$this->assertSame( 'image/jpeg', $data['mime_type'] );
 	}
 
+	/**
+	 * Ensures int-castable `filesize` values in attachment metadata are normalized
+	 * to an integer in the response.
+	 *
+	 * Attachment metadata is untyped, so plugins that populate `filesize` from
+	 * a remote storage API may store it as a string.
+	 *
+	 * @ticket 65670
+	 *
+	 * @dataProvider data_valid_filesize_meta
+	 *
+	 * @param mixed $stored_filesize   Valid `filesize` metadata value.
+	 * @param int   $expected_filesize Expected `filesize` value in the REST response after normalization.
+	 */
+	public function test_get_item_normalizes_int_castable_filesize_meta( $stored_filesize, int $expected_filesize ) {
+		$attachment_id = self::factory()->attachment->create_object(
+			array(
+				'file'           => self::$test_file,
+				'post_mime_type' => 'image/jpeg',
+			)
+		);
+		$this->assertIsInt( $attachment_id );
+
+		$meta             = wp_get_attachment_metadata( $attachment_id );
+		$meta             = is_array( $meta ) ? $meta : array();
+		$meta['filesize'] = $stored_filesize;
+		$this->assertNotFalse( wp_update_attachment_metadata( $attachment_id, $meta ) );
+
+		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
+		$response = rest_get_server()->dispatch( $request );
+		$data     = $response->get_data();
+
+		$this->assertIsArray( $data );
+		$this->assertSame( 200, $response->get_status() );
+		$this->assertSame( $expected_filesize, $data['filesize'] );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, array{ 0: mixed, 1: int }>
+	 */
+	public function data_valid_filesize_meta(): array {
+		return array(
+			'integer string'      => array( '123456', 123456 ),
+			'float string'        => array( '123.4', 123 ),
+			'scientific notation' => array( '1e3', 1000 ),
+			'float'               => array( 123.0, 123 ),
+		);
+	}
+
+	/**
+	 * Ensures a `filesize` metadata value that is not a positive number does not
+	 * cause a fatal TypeError or a bogus size cast from a non-numeric value,
+	 * falling back to the actual file size instead.
+	 *
+	 * Numeric values are trusted and cast to an integer instead, per
+	 * {@see self::test_get_item_normalizes_int_castable_filesize_meta()}.
+	 *
+	 * @ticket 65670
+	 *
+	 * @dataProvider data_invalid_filesize_meta
+	 *
+	 * @param mixed $filesize Invalid `filesize` metadata value.
+	 */
+	public function test_get_item_recovers_from_invalid_filesize_meta( $filesize ) {
+		$attachment_id = self::factory()->attachment->create_object(
+			array(
+				'file'           => self::$test_file,
+				'post_mime_type' => 'image/jpeg',
+			)
+		);
+		$this->assertIsInt( $attachment_id );
+
+		$meta             = wp_get_attachment_metadata( $attachment_id );
+		$meta             = is_array( $meta ) ? $meta : array();
+		$meta['filesize'] = $filesize;
+		$this->assertNotFalse( wp_update_attachment_metadata( $attachment_id, $meta ) );
+
+		$request  = new WP_REST_Request( 'GET', '/wp/v2/media/' . $attachment_id );
+		$response = rest_get_server()->dispatch( $request );
+		$data     = $response->get_data();
+
+		$this->assertIsArray( $data );
+		$this->assertSame( 200, $response->get_status() );
+		$this->assertIsInt( $data['filesize'] );
+		$attached_file = wp_get_original_image_path( $attachment_id );
+		$attached_file = $attached_file ? $attached_file : get_attached_file( $attachment_id );
+		$this->assertIsString( $attached_file );
+		$this->assertSame( filesize( $attached_file ), $data['filesize'] );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, array{ 0: mixed }>
+	 */
+	public function data_invalid_filesize_meta(): array {
+		return array(
+			'non-numeric string'      => array( 'corrupt' ),
+			'boolean'                 => array( true ),
+			'zero'                    => array( 0 ),
+			'zero string'             => array( '0' ),
+			'negative integer'        => array( -5 ),
+			'negative integer string' => array( '-5' ),
+		);
+	}
+
 	/**
 	 * @requires function imagejpeg
 	 */